Industry Guide

DPDPA for Recruitment and Staffing Agencies

Recruitment agencies sit on a mountain of personal data: CVs, job applications, background documents, interview notes, and client submissions. Under DPDPA, your biggest risks usually sit in candidate consent, profile sharing, ATS vendors, retention, and rights handling. This guide shows where recruitment workflows break, and what to tighten before they become liabilities.

If your CV database has no clear consent, purpose, or deletion logic, it is not a talent asset. It is a compliance trap.

“Find out whether your recruitment workflows create DPDPA exposure in 10 minutes.”

Key Risk Areas

CV / Resume Databases

High Risk

Storing thousands of CVs without defined consent, purpose, or retention period creates significant exposure.

Recommended action: Audit your ATS and email for all stored CVs. Implement a consent-at-submission form and a deletion policy for inactive candidates.

Candidate Profile Sharing

High Risk

Sharing resumes with clients without explicit candidate consent is a disclosure violation.

Recommended action: Update your candidate submission forms to include consent for specific sharing purposes. Update client agreements to reflect data sharing scope.

Background Check Documents

High Risk

Aadhaar, PAN, education certificates, and employment letters collected for background checks must be handled with strict controls.

Recommended action: Collect only documents necessary for the specific check. Define retention limits. Store with access restrictions.

ATS and Third-Party Platforms

Medium Risk

Cloud-based ATS platforms are Data Processors. Without a Data Processing Agreement, you have unmanaged third-party risk.

Recommended action: Sign DPAs with all ATS vendors. Verify their security certifications. Understand where they store data.

Cross-Border Data Flows

Medium Risk

International placements or overseas clients require careful review of data transfer obligations.

Recommended action: Map all cross-border data flows. Monitor permitted destinations list when notified. Update contracts with overseas clients.

Candidate Data Rights

Medium Risk

Candidates can request access, correction, or deletion of their data. Without a process, you risk Board complaints.

Recommended action: Create a candidate data rights request process. Publish contact details in your job posting terms and website.

Compliance Checklist

Map all candidate data locations (ATS, email, cloud, spreadsheets)

Add consent language to all candidate submission forms

Separate consent: data storage vs profile sharing vs future opportunities

Define and document candidate data retention periods

Implement a deletion process for inactive candidates (e.g., 12 months post-rejection)

Sign Data Processing Agreements with all ATS and HR tech vendors

Update client agreements to specify data sharing scope and restrictions

Create a candidate data rights request process and publish it

Train recruiters on what data they can share and with whom

Audit cloud storage and email for legacy candidate data

Take the Free Assessment

8 questions. 10 minutes. Get your personalised risk score and recommendations.

Start Assessment →

Free White Paper

45-page visual guide to DPDPA compliance for Indian businesses.

Download DPDPA White Paper →

Related Briefings

→ CV Database Risk for Recruitment Agencies → Consent Notice Requirements → Rights of Data Principals

Need specific guidance?

Our advisory team has worked with recruitment agencies of all sizes on DPDPA compliance.

Request Consultation →

Last reviewed: March 2026

Legal baseline: DPDP Rules, 2025 notified on 14 November 2025, with phased commencement.

This page is for educational purposes and does not constitute legal advice.